MITRE ATT&CKsoftware (tool)
S0581 IronNetInjector
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2021-02-24
Description
IronNetInjector is a Turla toolchain that utilizes scripts from the open-source IronPython implementation of Python with a .NET injector to drop one or more payloads including ComRAT.
Related
Uses · MITRE ATT&CK (8)
- T1027.013 Encrypted/Encoded File sub-technique
- T1059.006 Python sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1055.001 Dynamic-link Library Injection sub-technique
- T1053.005 Scheduled Task sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1055 Process Injection technique
- T1057 Process Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G0010 Turla group
References
- https://unit42.paloaltonetworks.com/ironnetinjector/ Unit 42 IronNetInjector February 2021